Palo Alto Networks Tenant Service Groups API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Tenant Service Groups API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Tenant Service Groups
  description: Tenant Service Group lifecycle management and hierarchy queries.
paths:
  /tenant-service-groups:
    get:
      operationId: listTenantServiceGroups
      summary: Palo Alto Networks List Tenant Service Groups
      description: Returns the list of Tenant Service Groups accessible to the authenticated service account. Results include the TSG hierarchy metadata, license counts, and current status. Supports filtering and pagination for tenants managing large numbers of TSGs.
      tags:
      - Tenant Service Groups
      parameters:
      - name: parent_id
        in: query
        description: Filter to return only direct children of the specified TSG ID.
        schema:
          type: string
        example: '182341'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of TSGs to return per page.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Tenant Service Groups returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of TSGs matching the query.
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                ListTenantServiceGroups200Example:
                  summary: Default listTenantServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    total: 242
                    offset: 963
                    limit: 823
                    items:
                    - id: example-id
                      display_name: Carlos Chen
                      description: Traffic threat traffic detected detected on.
                      parent_id: '413395'
                      support_account_id: '979872'
                      vertical: example-vertical
                      region: eu-west-1
                      status: active
                      child_count: 782
                      created_at: '2024-11-10T07:08:17Z'
                      updated_at: '2026-12-02T12:47:54Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups400Example:
                  summary: Default listTenantServiceGroups 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups401Example:
                  summary: Default listTenantServiceGroups 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups403Example:
                  summary: Default listTenantServiceGroups 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups500Example:
                  summary: Default listTenantServiceGroups 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createTenantServiceGroup
      summary: Palo Alto Networks Create Tenant Service Group
      description: Creates a new Tenant Service Group. A parent TSG ID must be provided to place the new TSG within the hierarchy. The creating account must have administrative access to the parent TSG.
      tags:
      - Tenant Service Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantServiceGroupRequest'
            examples:
              CreateTenantServiceGroupRequestExample:
                summary: Default createTenantServiceGroup request
                x-microcks-default: true
                value:
                  display_name: John Kumar
                  description: Activity activity alert investigation configured policy blocked rule monitoring configured alert Security.
                  parent_id: '266024'
                  support_account_id: '233774'
                  vertical: example-vertical
                  region: eu-west-1
      responses:
        '201':
          description: Tenant Service Group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                CreateTenantServiceGroup201Example:
                  summary: Default createTenantServiceGroup 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    display_name: Carlos Chen
                    description: Traffic threat traffic detected detected on.
                    parent_id: '413395'
                    support_account_id: '979872'
                    vertical: example-vertical
                    region: eu-west-1
                    status: active
                    child_count: 782
                    created_at: '2024-11-10T07:08:17Z'
                    updated_at: '2026-12-02T12:47:54Z'
        '400':
          description: Invalid request body or missing required fields.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup400Example:
                  summary: Default createTenantServiceGroup 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup401Example:
                  summary: Default createTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions on the parent TSG.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup403Example:
                  summary: Default createTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '409':
          description: A TSG with this name already exists under the parent.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup409Example:
                  summary: Default createTenantServiceGroup 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup500Example:
                  summary: Default createTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /tenant-service-groups/{tsg_id}:
    get:
      operationId: getTenantServiceGroup
      summary: Palo Alto Networks Get Tenant Service Group Details
      description: Returns full details for a specific Tenant Service Group including its parent, display name, description, license allocations, and current status.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the Tenant Service Group.
        schema:
          type: string
        example: '725984'
      responses:
        '200':
          description: Tenant Service Group details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                GetTenantServiceGroup200Example:
                  summary: Default getTenantServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    display_name: Carlos Chen
                    description: Traffic threat traffic detected detected on.
                    parent_id: '413395'
                    support_account_id: '979872'
                    vertical: example-vertical
                    region: eu-west-1
                    status: active
                    child_count: 782
                    created_at: '2024-11-10T07:08:17Z'
                    updated_at: '2026-12-02T12:47:54Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup401Example:
                  summary: Default getTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup403Example:
                  summary: Default getTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup404Example:
                  summary: Default getTenantServiceGroup 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup500Example:
                  summary: Default getTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateTenantServiceGroup
      summary: Palo Alto Networks Update Tenant Service Group
      description: Updates the display name, description, or contact information for an existing Tenant Service Group. The TSG ID and parent relationship cannot be changed after creation.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the Tenant Service Group to update.
        schema:
          type: string
        example: '507202'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantServiceGroupUpdate'
            examples:
              UpdateTenantServiceGroupRequestExample:
                summary: Default updateTenantServiceGroup request
                x-microcks-default: true
                value:
                  display_name: Carlos Wilson
                  description: Policy suspicious policy firewall alert network policy.
                  vertical: example-vertical
      responses:
        '200':
          description: Tenant Service Group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                UpdateTenantServiceGroup200Example:
                  summary: Default updateTenantServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    display_name: Carlos Chen
                    description: Traffic threat traffic detected detected on.
                    parent_id: '413395'
                    support_account_id: '979872'
                    vertical: example-vertical
                    region: eu-west-1
                    status: active
                    child_count: 782
                    created_at: '2024-11-10T07:08:17Z'
                    updated_at: '2026-12-02T12:47:54Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup400Example:
                  summary: Default updateTenantServiceGroup 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup401Example:
                  summary: Default updateTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup403Example:
                  summary: Default updateTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup404Example:
                  summary: Default updateTenantServiceGroup 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup500Example:
                  summary: Default updateTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteTenantServiceGroup
      summary: Palo Alto Networks Delete Tenant Service Group
      description: Deletes a Tenant Service Group. The TSG must have no child TSGs and no active service subscriptions before deletion. This action is irreversible.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the Tenant Service Group to delete.
        schema:
          type: string
        example: '214309'
      responses:
        '204':
          description: Tenant Service Group deleted successfully.
        '400':
          description: TSG has child TSGs or active subscriptions and cannot be deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup400Example:
                  summary: Default deleteTenantServiceGroup 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup401Example:
                  summary: Default deleteTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup403Example:
                  summary: Default deleteTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup404Example:
                  summary: Default deleteTenantServiceGroup 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup500Example:
                  summary: Default deleteTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /tenant-service-groups/{tsg_id}/children:
    get:
      operationId: listChildTenantServiceGroups
      summary: Palo Alto Networks List Child Tenant Service Groups
      description: Returns all direct child Tenant Service Groups of the specified TSG. Use this endpoint to traverse the TSG hierarchy when managing multi-level tenant structures.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the parent Tenant Service Group.
        schema:
          type: string
        example: '449835'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of child TSGs to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Child Tenant Service Groups returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of direct children.
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                ListChildTenantServiceGroups200Example:
                  summary: Default listChildTenantServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    total: 806
                    offset: 520
                    limit: 463
                    items:
                    - id: example-id
                      display_name: Carlos Chen
                      description: Traffic threat traffic detected detected on.
                      parent_id: '413395'
                      support_account_id: '979872'
                      vertical: example-vertical
                      region: eu-west-1
                      status: active
                      child_count: 782
                      created_at: '2024-11-10T07:08:17Z'
                      updated_at: '2026-12-02T12:47:54Z'
                    - id: example-id
                      display_name: Carlos Chen
                      description: Traffic threat traffic detected detected on.
                      parent_id: '413395'
                      support_account_id: '979872'
                      vertical: example-vertical
                      region: eu-west-1
                      status: active
                      child_count: 782
                      created_at: '2024-11-10T07:08:17Z'
                      updated_at: '2026-12-02T12:47:54Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups401Example:
                  summary: Default listChildTenantServiceGroups 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups403Example:
                  summary: Default listChildTenantServiceGroups 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Parent Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups404Example:
                  summary: Default listChildTenantServiceGroups 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups500Example:
                  summary: Default listChildTenantServiceGroups 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    TenantServiceGroupRequest:
      type: object
      required:
      - display_name
      - parent_id
      properties:
        display_name:
          type: string
          description: Display name for the new TSG.
          maxLength: 256
          example: John Kumar
        description:
          type: string
          description: Optional description of the TSG's purpose.
          maxLength: 1024
          example: Activity activity alert investigation configured policy blocked rule monitoring configured alert Security.
        parent_id:
          type: string
          description: ID of the parent TSG under which to create this TSG.
          example: '266024'
        support_account_id:
          type: string
          description: Palo Alto Networks support account ID to associate with this TSG.
          example: '233774'
        vertical:
          type: string
          description: Industry vertical classification.
          example: example-vertical
        region:
          type: string
          description: Primary geographic region.
          example: eu-west-1
    TenantServiceGroupUpdate:
      type: object
      properties:
        display_name:
          type: string
          description: New display name for the TSG.
          maxLength: 256
          example: Carlos Wilson
        description:
          type: string
          description: Updated description.
          maxLength: 1024
          example: Policy suspicious policy firewall alert network policy.
        vertical:
          type: string
          description: Updated industry vertical classification.
          example: example-vertical
    TenantServiceGroup:
      type: object
      properties:
        id:
          type: string
          descript

# --- truncated at 32 KB (34 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-tenant-service-groups-api-openapi.yml